Intune : Create Compliance Policy and automatically open tickets for non compliant devices

I – What is Compliance Policy ?

A “Compliance Policy” in Microsoft Intune is used to define rules and conditions that managed devices must respect in order to be considered compliant. These policies help to secure the organization’s data and resources by ensuring that only compliant devices can access these resources.

Here are some key points about “Compliance Policies” in Intune :

• Compliance assessment : devices are assessed according to the rules defined in the compliance policy. For example, you can require a minimum operating system version or the presence of anti-virus software.
• Action in the event of non-compliance : If a device does not comply with the rules, action can be taken, such as sending a notification to the user or blocking access to company resources.
• Integration with conditional access : Compliance results can be used with Microsoft Entra conditional access to add an extra layer of security. This ensures that only compliant devices can access sensitive resources.

In this article, I’m going to show you how to create a compliance policy in Intune, Microsoft’s Mobile Device Management (MDM) solution and to link non compliant devices notification with your system ticket.

II – Prerequisites :

• Intune subscription
• Access to Intune with global Admin rights
• Enrolled devices in Intune
• If you use Conditional Access, then you need Microsoft Entra ID P1 or P2 edition.

• Use a supported platform : Android , iOS, Windows 10/11 , MaxOS, Linux

III – Mindmap :

IV – Create a compliance policy with Microsoft Intune :

• Sign in to the Microsoft Intune admin center.
• Go to Devices > Compliance and choose Create policy.
• Select a Platform for this policy “Windows 10 and later“
• Then select Create to open the configuration page.

1. On the Basics tab, specify a Name that helps you identify them later.

• On the Compliance settings tab, expand the available categories, and configure settings for your policy as your convinience.

In device health section, I’ll require BitLocker, Secure Boot and Code Integrity.

In system security section, I’ll require this password complexity settings

Also Requiring :

• Firewall to be enabled
• TPM module
• Defender (You can jump this section if your’re not using Defender antivirus, but you can configure it as your company needs)
• Click “Next“.

On the Actions for noncompliance tab, specify a sequence of actions to apply automatically to devices that don’t meet this compliance policy.

Mark device noncompliant is selected by default, but we will comeback later to add another action here.

• On the Assignments tab, assign the policy to all devices (or you can just select groups).

• On the Review + create tab, review the settings and select Create when ready to save the compliance policy.

• here is our compliance policy created.

V – Create Notification for non compliant devices to be sent to Ticket system :

Nowadays, almost all ticketing systems are configured with a mailbox, allowing you to open a ticket as soon as you receive a new e-mail.

In this article, we’ll configure Intune to send notifications of non-compliant devices to the ticketing system to open a ticket and correct these problems as soon as possible.

To do this :

• Sign in to the Microsoft Intune admin center.
• Go to Devices > Compliance and choose “Notifications”.
• Select “Create Notification“

Enter Name in the Basics tab then click “Next“

• No need to make changes in this section just click next (you can adjust settings as your company needs).

• Enter the following information for the Notification message templates step:

Here is an example of the message I’m using :

Hello {{UserName}}

Your computer {{DeviceName}} is not compliant with company security rules.
You can continue to use your computer but a technician will contact you shortly to correct the problem.

Thank you
Your IT Team

• You can add another token to your message {{NonComplianceMessage}} to describe the reason of non compliant device.

Here is Notification message templates added.

• Click Next and review your notification.

• Click Create.

• Click Create.

• The notification message template is ready to use.

VI – Add Notification action in Compliance Policy to open Ticket for incompliant devices :

Before starting any configuration, you need to know that to perform this action, you need to have/create a Microsoft 365 group (you can do it from Exchange Online or from Azure) to group the addresses to be notified.

Once you’ve created the Microsoft 365 group and added the ticket system’s e-mail address to it, you need to authorize the reception of external e-mails (this little trick took me two days of research, why I don’t receive e-mails ? 🤣).

here is the steps to enable reciving external emails :

• Go to Exchange Admin center
• Go to groups
• Select “Microsoft 365” groups
• Select your group that contain system Ticket email
• Go to settings then select “Allow external senders to email this group“
• Select “Save“

Now that we are done with Microsoft 365 group, we can come back to configuration :

• Sign in to the Microsoft Intune admin center.
• Go to Devices > Compliance and choose Policies
• Open the recently created Compliance.

• Go to properties.

• Go to action for non compliance and select “Edit“

In the second line :

1. select “Send email to end user“
2. click “Select“
3. Select recently created notification message template
4. Click “Select“

• In addtional recipient section, add your Microsoft 365 group recently configured.
• Select “Review + Save“

• here you can see that notification action has been added to your compliance policy.

VII – Test Compliance Policy :

As you can see here, I have GIT0100 as compliant device, I will disable firewall to make device non compliant. Let’s see what’ happen.

Here, I have disabled firewall.

We need to start manual sync to get result quickly.

As you can see ma device is no more compliant.

Intune will now send two notifications :

• one for the end user
• one for the ticket system

Here is new email recived in my Helpdesk mailbox as you can see, a new ticket will created automatically.

Conclusion :

In summary, compliance policies in Microsoft Intune play a crucial role in securing corporate devices and data. By defining clear rules and monitoring device compliance, administrators can ensure that only secure, up-to-date devices access sensitive resources. Integration with conditional access further enhances this security, offering robust protection against potential threats. By adopting these policies, organizations can not only improve their security posture, but also simplify device management and reduce the risks associated with non-compliance.